[USN-3986-1] Wireshark vulnerabilities

[Mike Salvatore]

==========================================================================
Ubuntu Security Notice USN-3986-1
May 16, 2019

Wireshark vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Wireshark could be made to crash if it received specially crafted network
traffic or input files.

Software Description:
- wireshark: network traffic analyzer

Details:

It was discovered that Wireshark improperly handled certain input. A remote or
local attacker could cause Wireshark to crash by injecting malformed packets
onto the wire or convincing someone to read a malformed packet trace file.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  libwireshark-data               2.6.8-1~ubuntu18.10.0
  libwireshark11                  2.6.8-1~ubuntu18.10.0
  libwiretap8                     2.6.8-1~ubuntu18.10.0
  libwscodecs2                    2.6.8-1~ubuntu18.10.0
  libwsutil9                      2.6.8-1~ubuntu18.10.0
  tshark                          2.6.8-1~ubuntu18.10.0
  wireshark                       2.6.8-1~ubuntu18.10.0
  wireshark-common                2.6.8-1~ubuntu18.10.0
  wireshark-gtk                   2.6.8-1~ubuntu18.10.0
  wireshark-qt                    2.6.8-1~ubuntu18.10.0

Ubuntu 18.04 LTS:
  libwireshark-data               2.6.8-1~ubuntu18.04.0
  libwireshark11                  2.6.8-1~ubuntu18.04.0
  libwiretap8                     2.6.8-1~ubuntu18.04.0
  libwscodecs2                    2.6.8-1~ubuntu18.04.0
  libwsutil9                      2.6.8-1~ubuntu18.04.0
  tshark                          2.6.8-1~ubuntu18.04.0
  wireshark                       2.6.8-1~ubuntu18.04.0
  wireshark-common                2.6.8-1~ubuntu18.04.0
  wireshark-gtk                   2.6.8-1~ubuntu18.04.0
  wireshark-qt                    2.6.8-1~ubuntu18.04.0

Ubuntu 16.04 LTS:
  libwireshark-data               2.6.8-1~ubuntu16.04.0
  libwireshark11                  2.6.8-1~ubuntu16.04.0
  libwiretap8                     2.6.8-1~ubuntu16.04.0
  libwscodecs2                    2.6.8-1~ubuntu16.04.0
  libwsutil9                      2.6.8-1~ubuntu16.04.0
  tshark                          2.6.8-1~ubuntu16.04.0
  wireshark                       2.6.8-1~ubuntu16.04.0
  wireshark-common                2.6.8-1~ubuntu16.04.0
  wireshark-gtk                   2.6.8-1~ubuntu16.04.0
  wireshark-qt                    2.6.8-1~ubuntu16.04.0

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/usn/usn-3986-1
  CVE-2019-10894, CVE-2019-10895, CVE-2019-10896, CVE-2019-10899,
  CVE-2019-10901, CVE-2019-10903, CVE-2019-9208, CVE-2019-9209,
  CVE-2019-9214

Package Information:
  https://launchpad.net/ubuntu/+source/wireshark/2.6.8-1~ubuntu18.10.0
  https://launchpad.net/ubuntu/+source/wireshark/2.6.8-1~ubuntu18.04.0
  https://launchpad.net/ubuntu/+source/wireshark/2.6.8-1~ubuntu16.04.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20190516/84c4f1cc/attachment.sig>